IMG_pnm.c
branchSDL-1.2
changeset 607 1a1189c2978f
parent 280 ec4ae96c100c
     1.1 --- a/IMG_pnm.c	Tue Oct 16 10:50:15 2018 +0300
     1.2 +++ b/IMG_pnm.c	Tue Oct 16 20:02:02 2018 +0300
     1.3 @@ -27,6 +27,7 @@
     1.4   * Does not support: maximum component value > 255
     1.5   */
     1.6  
     1.7 +#include <limits.h>
     1.8  #include <stdio.h>
     1.9  #include <stdlib.h>
    1.10  #include <ctype.h>
    1.11 @@ -78,7 +79,7 @@
    1.12  	/* Skip leading whitespace */
    1.13  	do {
    1.14  		if ( ! SDL_RWread(src, &ch, 1, 1) ) {
    1.15 -			return(0);
    1.16 +			return(-1);
    1.17  		}
    1.18  		/* Eat comments as whitespace */
    1.19  		if ( ch == '#' ) {  /* Comment is '#' to end of line */
    1.20 @@ -91,7 +92,14 @@
    1.21  	} while ( isspace(ch) );
    1.22  
    1.23  	/* Add up the number */
    1.24 +	if (!isdigit(ch)) {
    1.25 +		return -1;
    1.26 +	}
    1.27  	do {
    1.28 +		/* Protect from possible overflow */
    1.29 +		if (number >= INT_MAX / 10) {
    1.30 +			return -1;
    1.31 +		}
    1.32  		number *= 10;
    1.33  		number += ch-'0';
    1.34  
    1.35 @@ -177,13 +185,13 @@
    1.36  		c[1].r = c[1].g = c[1].b = 0;
    1.37  		surface->format->palette->ncolors = 2;
    1.38  		bpl = (width + 7) >> 3;
    1.39 -		buf = malloc(bpl);
    1.40 +		buf = (Uint8 *)malloc(bpl);
    1.41  		if(buf == NULL)
    1.42  			ERROR("Out of memory");
    1.43  	}
    1.44  
    1.45  	/* Read the image into the surface */
    1.46 -	row = surface->pixels;
    1.47 +	row = (Uint8 *)surface->pixels;
    1.48  	for(y = 0; y < height; y++) {
    1.49  		if(ascii) {
    1.50  			int i;